On 12 September 2024 the Privacy and Other Legislation Amendment Bill 2024 (Bill) was introduced into parliament. Constituting the first tranche of proposed privacy reforms we have previously considered, if enacted, the reforms will introduce a new cause of action allowing individuals to sue for a serious invasion of their privacy. It will fundamentally change the way people think about privacy and require individuals, businesses and government departments to change how they manage and treat people’s privacy.

Statutory tort for a serious invasion of privacy

Presently no statutory right of action prohibiting an invasion of privacy exists. The Bill incorporates a proposed law covering serious invasions of privacy involving the intrusion into a person’s seclusion, or misuse of their information. The law will allow an individual to bring a claim if:

• A person in their position would have had a reasonable expectation of privacy in all the circumstances and
• The invasion of privacy was intentional or reckless and
• The invasion of privacy was serious.

The test surrounding reasonableness is intended to be flexible to accommodate for changing views and expectations surrounding privacy. For a claim to succeed, an individual will need to demonstrate the public interest in protecting their privacy outweighs any competing public interest raised by the defendant.

Who can sue and be sued?

The law will have general application, meaning individuals, businesses and government institutions could be liable for breaches, but only individuals would be able to sue, most notably, without proof of damage.

Crown to be bound

Subject to any exemptions and exceptions, government departments and agencies will also be liable for any serious invasions of privacy.  Accordingly, possible actions, including class actions, could be initiated against departments regarding misuse of personal information and data breaches.

Public Interest

As part of the determination of whether there has been a serious invasion of privacy a Court will need to consider the public interest. This includes considering any of the following:

• Freedom of political communication
• Freedom of the media
• Proper administration of government
• Public health and safety
• National security.

Defences

The Bill has set out a number of proposed defences which include:

• Lawful authority
• Consent
• Necessity
• Defamation law defences (absolute privilege, publication of public documents and fair reporting on a matter of public concern).

Exemptions

Intelligence agencies, law enforcement bodies engaging in reasonably necessary conduct, and individuals under the age of 18 will be exempt from liability for any claims.

Journalists would also be exempt for acts involving the collection, preparation for publication or publication of the journalistic material if it:

• Has the character of news, current affairs or a documentary or
• Consists of commentary or opinion on, or analysis of, news, current affairs or a documentary.

This exemption would not extend to sources or ‘whistle blowers’ and would not extend to material by journalists that was not ‘news, current affairs or a documentary’ (or commentary or opinion on these matters). It would also not extend to ‘citizen journalists’.

Defamation

In many ways, an action for serious invasion of privacy would have similarities to a defamation action. Indeed, it is anticipated that many actions for defamation could be expanded to include an allegation of a serious invasion of privacy against a party, including for sources to also be included as a party to any proceedings.

Limitations

The Bill provides that a person must commence an action one year after the day on which they became aware of the invasion of privacy and the day that is three years after the invasion of privacy occurred. However, if a person was under 18 years of age when the invasion of privacy occurred, the action may be commenced before their 21st birthday.

Who will be impacted?

Under the Bill, the misuse of information is intended to encompass a wide range of activities, including (but not limited to) invasions of privacy by collecting, using, and disclosing information. This includes storing, interfering with or modifying information. ‘Intrusions of privacy’ is also purposefully broadly framed and would extend to following, listening, recording and spying as well other practices that are common online and in the digital/ surveillance economy, especially regarding advertising and marketing.

The broad scope of the Bill has the potential to impact numerous people and businesses and expose them to new liabilities. For example:

• Data breaches: if there is a data breach, especially if the personal information is published
• Employment: workplace surveillance, invasions of employees’ personal lives, employees/ contractors misusing or accessing information without authorisation (need to know basis issues)
• Services including financial services: collections and disclosures of information from/ to third parties, without an individual’s consent (loans, insurance coverage etc)
• Advertising/ marketing: disclosure/ sale of private information to third parties without consent
• Domestic relationships: surveillance, sharing of intimate images and videos
• Social media: embarrassing videos, pranks and other content without consent
• Surveillance and investigations: private investigations, including fraud investigations
• Confidentiality: access by third parties to documents without consent including contracts and agreements, non-disclosure agreements and other confidential information
• Property rights and nuisances: neighbour issues, including security cameras invading the privacy of neighbours
• Unauthorised descriptions of individuals, events and biographies: would not be considered journalistic material.

Media organisations will be impacted as many stories featuring individuals in intimate or private circumstances, embarrassing or compromising situations may not fall under the ‘journalistic material’ exemption, as the material would not be defined as having the character of ‘news, current affairs or documentaries.’ This may include media stories regarding relationships, gossip and rumours, photographs including unauthorised use and paparazzi-style photographs, an individual’s personal history, medical and rehab clinic visits, tabloid and clickbait articles. In other words, a considerable amount of content that is currently publishable would be at risk of significantly liability upon the implementation of the law regarding serious invasions of privacy unless one of the defences was able to be established.

This Bill also promotes the right to security by deterring a serious invasion of privacy that might involve an intrusion onto a person’s property, unauthorised surveillance or sharing information that enables a person to be identified or located. Therefore, individuals filming others (including posting on social media) without consent could constitute a serious invasion of privacy.

Remedies

If a person establishes a serious invasion of their privacy, a Court will have the flexibility to apply a variety of remedies including:

• Compensatory damages
• Exemplary damages
• Injunctions
• Account of profits
• Correction orders
• Delivery up, destruction or removal of materials
• Apology orders.

There would be no limit to damages for economic loss.

The total cap on damages for non-economic loss and punitive damages is set at $478,550 or the maximum allowed in defamation law, whichever is greater.

Conclusion

The creation of a new law regarding serious invasions of privacy introduces extensive new rights for individuals. It proposes to completely reformulate Australia’s privacy landscape. Consequently, the Bill proposes new risks for both individuals, businesses, and government institutions. Further, businesses and government institutions could be held vicariously liable for the conduct of their employees and contractors, and those employees and contractors could also be held personally liable for any actions involving a serious invasion of privacy.

To date, individuals and some businesses have been largely exempted from liability from privacy laws. With the introduction of laws regarding serious invasions of privacy, there will be fundamental reframing of privacy laws in Australia that will impact many personal behaviours and business practices that, to date, have been barely tolerated if not maligned.

Should you wish to discuss the Bill, privacy rights and obligations, please do not hesitate to contact us. We also deliver presentations and training to our clients on privacy laws, data breaches and the implications of privacy law reforms.

Further information / assistance regarding the issues raised in this article is available from the author, Bill Fragos, Special Counsel or Emily Jarman, Lawyer, or your usual contact at Moray & Agnew.